As cited
Copy frozen at (site build).
threat intel
Pegasus, NoviSpy variant spyware found on devices of Serbian activists
Researchers confirmed the first Pegasus spyware infection of 2026 targeting a Serbian student activist, alongside infections with a NoviSpy variant affecting 14 people total, including a member of parliament and local official. The infections coincided with anti-government protests and upcoming elections, with evidence suggesting Serbian police or secret service deployed the spyware. Citizen Lab confirmed the Pegasus infection with high probability, while Amnesty International verified the NoviSpy cases, noting they occurred during police detention.
Why it matters: Security teams and human rights organizations should track spyware campaigns targeting activists and journalists in Serbia and similar jurisdictions, as this represents the largest documented surveillance wave there and signals continued political repression via commercially available espionage tools; practitioners should ensure their organizations' threat intelligence includes NSO Group Pegasus indicators of compromise (IOCs) and deployment patterns.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Pegasus, NoviSpy variant spyware found on devices of Serbian activists
Researchers confirmed the first Pegasus spyware infection of 2026 targeting a Serbian student activist, alongside infections with a NoviSpy variant affecting 14 people total, including a member of parliament and local official. The infections coincided with anti-government protests and upcoming elections, with evidence suggesting Serbian police or secret service deployed the spyware. Citizen Lab confirmed the Pegasus infection with high probability, while Amnesty International verified the NoviSpy cases, noting they occurred during police detention.
Why it matters: Security teams and human rights organizations should track spyware campaigns targeting activists and journalists in Serbia and similar jurisdictions, as this represents the largest documented surveillance wave there and signals continued political repression via commercially available espionage tools; practitioners should ensure their organizations' threat intelligence includes NSO Group Pegasus indicators of compromise (IOCs) and deployment patterns.
- Source published
- First seen by Cybersecurity Tracker